Legal Framework for SaaS in Bangladesh
Statutory Compliance Matrix
| Regulatory Domain | Primary Statute | Key Compliance Requirement |
|---|---|---|
| Data Protection | ICT Act 2006 (Sec. 63) | Confidentiality and non-disclosure of electronic records. |
| Cyber Security | Cyber Security Act 2023 | Mandatory reporting of security breaches to the National CERT. |
| Consumer Rights | Consumer Rights Protection Act 2009 | Protection against unfair trade practices in digital service delivery. |
| Foreign Exchange | FERA 1947 (Sec. 18) | Compliance for cross-border remittance of subscription fees. |
Data Sovereignty and Residency
Under the Cyber Security Act 2023, the government reserves the right to declare certain data as 'Critical Information Infrastructure' (CII). SaaS providers must ensure that MSAs include clauses for data localization if the client belongs to a CII sector (e.g., Banking, Power, Health). Failure to comply with data access requests by law enforcement under Section 42 of the Cyber Security Act 2023 can lead to significant penal consequences.
Essential Clauses for Bangladesh MSAs
- Data Ownership: Explicitly state that the 'Customer' remains the sole owner of 'Customer Data' as per Section 43 of the ICT Act 2006.
- Indemnification: Limit liability for service interruptions while maintaining uncapped liability for data breaches resulting from gross negligence.
- Dispute Resolution: Preference for arbitration under the Arbitration Act 2001, with the seat in Dhaka for local enforcement efficiency.
- Taxation: SaaS is categorized as 'Service' subject to VAT under the Value Added Tax and Supplementary Duty Act 2012.
Consult Barrister Liton Asaduzzaman Sarkar
Ensure your SaaS contracts are compliant with evolving Bangladesh cyber laws.
Schedule Legal ScopingFrequently Asked Questions
Is data localization mandatory for all SaaS providers in Bangladesh?
Currently, mandatory localization is sector-specific. However, for Critical Information Infrastructure (CII) entities, the Cyber Security Act 2023 and Bangladesh Bank's Cloud Computing Guidelines necessitate local data residency or specific regulatory approvals.
What are the penalties for unauthorized access to data under Bangladesh law?
Under Section 66 of the ICT Act 2006 (as amended), hacking or unauthorized access to computer systems carries a penalty of imprisonment for up to 14 years or a fine up to BDT 1 crore, or both.
How is VAT applied to SaaS subscriptions in Bangladesh?
SaaS is generally treated as a taxable service. Under the Value Added Tax and Supplementary Duty Act 2012, providers must register for VAT and charge the prevailing rate (typically 5% to 15% depending on the service category) on invoices.
◆ Related Statutory Guides & Practice Insights
<li style="margin-bottom:12px; line-height:1.5;">
<a href="/en/corporate-bank-account-opening-foreign-companies-bangladesh/" style="color:#C5A059; font-weight:600; text-decoration:none; font-size:14px; display:inline-block; transition:color 0.2s;">• Corporate Bank Account Opening for Foreign Firms in Bangladesh</a>
</li>
<li style="margin-bottom:12px; line-height:1.5;">
<a href="/en/external-commercial-borrowings-bida-bangladesh-bank/" style="color:#C5A059; font-weight:600; text-decoration:none; font-size:14px; display:inline-block; transition:color 0.2s;">• ECB Scrutiny: BIDA & Bangladesh Bank Approvals</a>
</li>
<li style="margin-bottom:12px; line-height:1.5;">
<a href="/en/freelancer-banking-erq-account-inward-remittance-bangladesh/" style="color:#C5A059; font-weight:600; text-decoration:none; font-size:14px; display:inline-block; transition:color 0.2s;">• Freelancer Banking in Bangladesh: Master Legal Guide to 70% ERQ Accounts, Inward Remittance Verification & Tax Exemption Proof</a>
</li>
<li style="margin-bottom:12px; line-height:1.5;">
<a href="/en/bangladesh-bank-regulations-for-financial-institutions/" style="color:#C5A059; font-weight:600; text-decoration:none; font-size:14px; display:inline-block; transition:color 0.2s;">• Bangladesh Bank Regulations for Financial Institutions</a>
</li>